Commercial one-time password generators have been widely used in industry for over a decade, but have not seen widespread use in consumer applications such as online banking and brokerage account management, especially within the United States. The use of one-time passwords for access to sensitive information eliminates both the need for a user to remember passwords that are difficult to guess and the tendency for users to use the same password for multiple accounts and never change passwords. However, it requires a user and an entity, e.g., a bank or brokerage firm, that is authenticating the user to both have access to the same sequence of one-time passwords.
In a token based approach, a company may provide a token to the user as part of a two-part authentication process for accessing a single account. A token is a device or software that contains one or more sequence generators. A sequence generator is an algorithm that generates a pseudorandom sequence of numeric or alpha-numeric values of 6 to 8 digits. The sequence generator uses the current value to compute the next value.
A server generates and maintains the same pseudorandom sequence generated by the token. Each value remains valid for a short time period, e.g., one minute. The user may be authenticated by entering a static personal identification number (PIN) along with the current value from the sequence generator as a password when accessing the entity. The PIN prevents someone else from using the token to access a user's account. The server will verify that the value entered by the user, combined with the pin, matches the current value in the sequence.
Disadvantageously, the cost of providing a token to each customer makes the use of tokens unappealing to businesses having a large customer base. Also disadvantageously, administrative issues, such as a) how to deal with lost or stolen tokens, b) aging tokens that must be replaced periodically, c) tokens that become out-of-synch with the server, and d) tokens that stop working prior to the expiration date as its power supply dies, make the use of tokens unappealing to some businesses. Further disadvantageously, the need to have a separate token or device per account is unappealing from the customer's perspective, no matter how compact the device is physically.
An alternative to providing a token to customers is to use some form of out-of-band communication, such as Short Message Service (SMS), to provide consumers with one-time passwords. Disadvantageously, this alternative relies on the out-of-band communication, which may fail, become slow or vulnerable to attacks.